Clover and Pilotiko: linking your terminal's merchant account
For service businesses that take payments on a Clover terminal.
Pilotiko can link your Clover merchant account today: you sign in at Clover, authorize the app, and Pilotiko keeps the token encrypted. It reads no terminal transaction and creates none. Status: Account connection only: no automatic actions for now. Your counter payments stay entirely in Clover.
In short
- Status: Account connection only: no automatic actions for now.
- No scope is written into the request: with Clover, access depends on the app.
- Clover issues a token pair that expires and must be renewed.
- Reading terminal orders or payments is not wired up.
What does the Clover connection do in Pilotiko?
It links your Clover merchant account to Pilotiko through OAuth. Nothing else happens afterwards, for now.
Clover describes its OAuth plainly: the merchant logs in and authorizes the app to access their data, then returns to the app with a code that the app exchanges for an access token and a refresh token [1]. Pilotiko follows that exact path. Its registry files Clover under Payments with a connect-only status.
One detail visible in the code: the request sent to Clover carries no scope at all; the list is empty. Clover says REST API calls need a token with specific permissions [2], but the page we read does not say where those permissions are set, so we do not claim it here. What is certain: Pilotiko uses the token for no call.
The code exchange happens server-side, in JSON, without PKCE. Clover reserves PKCE for low-trust apps such as mobile or desktop apps that cannot keep a secret [1]; Pilotiko keeps its secret on its server.
- Data read today: none. No orders, payments or terminal inventory.
- Data written today: none. No charge, refund or item change.
- What is stored: the access and refresh tokens, encrypted, plus the linked account's name.
- What will need approval later: any future refund or charge, like every Pilotiko action that touches money.
How do I connect Clover to Pilotiko?
Use the Clover login of the owner or a manager. If Pilotiko has not enabled its Clover app for your business, the card says so instead of showing a button.
- 1
Open Connections
In Pilotiko, find the Clover card under Payments.
- 2
Click Connect
Pilotiko creates a one-time request tied to your business and your user that expires after 10 minutes.
- 3
Sign in at Clover
Enter your Clover credentials and pick the right merchant.
- 4
Authorize the app
Clover sends you back with a code, exchanged for the token pair.
- 5
Check the card
It reads Connected and reminds you that nothing runs automatically.
What is available, being commissioned or coming soon with Clover?
| Function | Status | Detail |
|---|---|---|
| Link the Clover merchant account | Account connection only: no automatic actions for now | Token pair encrypted |
| Read terminal payments | Coming soon | No Clover REST API call |
| Read orders and items | Coming soon | Nothing is imported |
| Refund from Pilotiko | Coming soon | Will need a person's approval |
| Remove the connection in Pilotiko | Available | Tokens erased, audit log entry |
What happens to a week of Clover transactions?
How does Pilotiko handle Clover access under Law 25?
The token is encrypted (AES-256-GCM) and never leaves the server. Quebec's act calls for security measures that are reasonable given how sensitive the information is, and for consent given for specific purposes that lasts only as long as needed [4]. The Clover link is therefore optional, explained and reversible.
If transactions are read one day, they could be stored outside Quebec depending on hosting; the act then requires a privacy impact assessment before any communication outside Quebec [4]. See security and privacy.
Revoking: Pilotiko's Disconnect button erases the tokens and logs the action. On the Clover side, the pages we read do not describe how to remove an app; check your merchant account or ask Clover support.
What are the limits of the Clover connection?
Clover tokens expire: Clover asks apps to generate a new pair before the current one runs out [2]. If renewal fails, the card switches to reconnect. No real Clover account has been tried with Pilotiko yet, and the app is not registered.
To compare: Square asks for named permissions, Stripe goes through Connect. All three share the same status on the Integrations page. For the bookings you would match payments against, see Google Calendar.
Frequently asked questions
Does Pilotiko read the payments on my Clover terminal?
No. The link is stored, but no read is scheduled. Your transactions stay in Clover.
Why does the Clover request contain no scope?
Pilotiko's code passes none: the list is empty. Since the token is used for no call today, Pilotiko gains no practical access from it.
Does the Clover authorization expire?
Yes. Clover issues an expiring token pair that has to be renewed. If renewal fails, Pilotiko asks you to reconnect.
Who on our team should make the connection?
Someone who can sign in to the business's Clover account, ideally the owner. They choose the merchant and authorize the app.
How do I remove access?
Click Disconnect in Pilotiko and the tokens are erased. To cut access on the Clover side too, go through your Clover merchant account.
Will Pilotiko be able to refund a customer through Clover?
Not today. If that feature arrives, every refund will wait for a person's approval before it is sent to Clover.
Sources
- Clover Developer Docs, OAuth: introduction (accessed on October 15, 2026).
- Clover Developer Docs, Use OAuth 2.0 (accessed on October 15, 2026).
- RFC Editor (IETF), RFC 6749 : The OAuth 2.0 Authorization Framework (accessed on October 15, 2026).
- LégisQuébec, Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) (accessed on October 15, 2026).
Read next
Pilotiko integrations
Google Calendar, Outlook, Zoom, Stripe, LinkedIn, Cloudflare, Twilio and more: what each Pilotiko connection does today, with its status read from the code.
Square and Pilotiko: your seller account linked, nothing automated
Square and Pilotiko: the three OAuth permissions requested, how long tokens last, what stays manual today and how to revoke Pilotiko's access.
Stripe and Pilotiko: linking your payments account
Connecting your Stripe account to Pilotiko: the read_write OAuth scope, what is wired up today, what is not yet, and how to remove Pilotiko's access.